CVE-2026-22695: LIBPNG Buffer Overflow Vulnerability

CVE-2026-22695 Overview

CVE-2026-22695 is an Out-of-Bounds Read vulnerability affecting libpng, the reference library used by applications to read, create, and manipulate PNG (Portable Network Graphics) raster image files. The vulnerability exists in versions 1.6.51 through 1.6.53 and manifests as a heap buffer over-read in the simplified API function png_image_finish_read when processing interlaced 16-bit PNG files with 8-bit output format and non-minimal row stride. This issue is a regression introduced by the fix for CVE-2025-65018.

Critical Impact

Processing maliciously crafted PNG files could lead to information disclosure from heap memory or cause application crashes through denial of service.

Affected Products

• libpng version 1.6.51
• libpng version 1.6.52
• libpng version 1.6.53

Discovery Timeline

• 2026-01-12 - CVE-2026-22695 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22695

Vulnerability Analysis

The vulnerability resides in the png_image_finish_read function within libpng's simplified API. When the library processes interlaced 16-bit PNG images with an 8-bit output format configured alongside a non-minimal row stride, the function fails to properly validate buffer boundaries during the image conversion process. This results in a heap buffer over-read condition where memory beyond the allocated buffer is accessed.

The vulnerability was inadvertently introduced as a regression when developers patched CVE-2025-65018. The fix for the previous vulnerability modified memory handling logic in a way that created an edge case affecting specific combinations of input parameters: interlaced images, 16-bit source depth, 8-bit output depth, and non-standard row stride configurations.

Root Cause

The root cause is improper bounds checking (CWE-125: Out-of-bounds Read) in the image processing pipeline when handling the specific combination of interlaced 16-bit PNG files converted to 8-bit output with non-minimal row stride. The regression in the CVE-2025-65018 fix altered the buffer size calculations without accounting for all potential stride configurations, leading to read operations that extend past the allocated heap buffer.

Attack Vector

The attack vector is local, requiring user interaction to open a maliciously crafted PNG file. An attacker would need to create a specially crafted interlaced 16-bit PNG file designed to trigger the vulnerable code path. When a victim opens this file using an application linked against the vulnerable libpng versions, the heap buffer over-read occurs. The exploitation scenario could include:

• Embedding malicious PNG files in documents or web pages
• Sending crafted images via email or messaging platforms
• Hosting malicious images on websites visited by potential victims

The vulnerability could result in information disclosure if sensitive data exists in adjacent heap memory, or cause denial of service through application crashes.

Detection Methods for CVE-2026-22695

Indicators of Compromise

• Unexpected application crashes when processing PNG image files
• Memory access violations or segmentation faults in applications using libpng
• Anomalous behavior when handling interlaced 16-bit PNG images
• Evidence of malformed PNG files with unusual interlacing and bit depth combinations

Detection Strategies

• Monitor applications for crashes or memory violations when processing PNG files
• Implement file integrity monitoring for PNG images in untrusted locations
• Use memory sanitizers (AddressSanitizer, Valgrind) during testing to detect out-of-bounds reads
• Audit libpng version strings in application dependencies to identify vulnerable installations

Monitoring Recommendations

• Enable crash reporting mechanisms to capture stack traces involving png_image_finish_read
• Monitor system logs for segmentation fault signals in PNG-processing applications
• Implement automated dependency scanning to track libpng versions across your environment

How to Mitigate CVE-2026-22695

Immediate Actions Required

• Update libpng to version 1.6.54 or later immediately
• Identify all applications and systems using libpng versions 1.6.51 through 1.6.53
• Rebuild applications that statically link against vulnerable libpng versions
• Exercise caution when opening PNG files from untrusted sources until patched

Patch Information

The vulnerability is fixed in libpng version 1.6.54. The fix addresses the buffer boundary calculation issue in the png_image_finish_read function. Detailed patch information is available through the GitHub Security Advisory and the relevant commits: commit 218612ddd6b17944e21eda56caf8b4bf7779d1ea and commit e4f7ad4ea2. Additional technical discussion is available in the GitHub Issue #778.

Workarounds

• Avoid processing untrusted PNG files until the library is updated
• If possible, configure applications to reject interlaced 16-bit PNG files temporarily
• Implement input validation to filter PNG files with specific characteristics before processing
• Use sandboxed environments for processing images from untrusted sources

# Verify installed libpng version
pkg-config --modversion libpng

# Update libpng on Debian/Ubuntu systems
sudo apt update && sudo apt install libpng16-16

# Update libpng on RHEL/CentOS systems
sudo yum update libpng